Isaca Updated CRISC Exam Questions and Answers by emmanuel

According to the 1.9 Ownership & Accountability - CRISC, risk ownership is best established by mapping risk to specific business process owners. Details of the risk owner should be documented in the risk register. Results of the risk monitoring should be discussed and communicated with the risk owner as they own the risk and are accountable for maintaining the risk within acceptable levels. To ensure effective risk ownership, it is most important that risk owners have decision-making authority, as this enables them totake timely and appropriate actions to manage the risk and ensure that it is aligned with the organization’s risk appetite and tolerance. Without decision-making authority, risk owners may not be able to implement the necessary risk responses or escalate the issues to the relevant stakeholders. Therefore, the answer is D. risk owners have decision-making authority. References = 1.9 Ownership & Accountability - CRISC, The Importance of Effective Risk Governance in the C-suite - Aon

 Cross-site scripting (XSS) and SQL injection are two common types of web application attacks that can compromise the confidentiality, integrity, and availability of data and systems. XSS allows an attacker to inject malicious code into a web page that is viewed by other users, while SQL injection allows an attacker to execute arbitrary commands on a database server by manipulating the input parameters of a web application. Both attacks can result in data theft, unauthorized access, defacement, denial of service, and more.

To mitigate these attacks, the best option is to require the software vendor to remediate the vulnerabilities by applying secure coding practices, such as input validation, output encoding, parameterized queries, and HTML sanitization. These techniques can prevent or limit the impact of XSS and SQL injection by ensuring that user input is not interpreted as code or commands by the web browser or the database server. The software vendor should also provide regular updates and patches to fix any known or newly discovered vulnerabilities.

The other options are not effective or acceptable ways to mitigate these attacks. Monitoring the databases for abnormal activity can help detect and respond to SQL injection attacks, but it does not prevent them from happening or address the root cause of the vulnerability. Approving an exception to allow the software to continue operating can expose the organization to unnecessary risks and liabilities, as well as violate compliance requirements and standards. Accepting the risk and letting the vendor run the software as is can also have serious consequences for the organization, as it implies that the potential impact and likelihood of the attacks are low or acceptable, which may not be the case. References =

IT Risk Resources | ISACA

CRISC Certification | Certified in Risk and Information Systems Control | ISACA

Cross Site Scripting Prevention Cheat Sheet - OWASP

A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm | EURASIP Journal on Information Security | Full Text

Difference Between XSS and SQL Injection - GeeksforGeeks

 The most important consideration when communicating the risk associated with technology end-of-life to business owners is the cost and benefit of the risk response options. Technology end-of-life is the situation when a technology product or service is no longer supported by the vendor or manufacturer, and may pose security, compatibility, or performance issues. The risk practitioner should communicate the cost and benefit of the possible risk responses, such as replacing, upgrading, or maintaining the technology, to the business owners, and help them to make informed and rational decisions. Security and availability, maintainability and reliability, and performance and productivity are other possible considerations, but they are not as important as the cost and benefit. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.